Authenticate API requests #53
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In general, it is expected that services require authentication even when called directly instead of through a gateway. This commit replaces the prior authentication strategy of setting the subject URN as the bearer token value with JWT bearer token authentication. To make local development easier, this commit also adds a mock-oauth2-server service to the dev container environment and an example config that uses it for JWT validation. Signed-off-by: John Schaeffer <[email protected]>
The urnx package provides a convenient way for us to parse Infratographer URNs across services. This commit updates permissions-api to use it for subject and resource URNs instead of string manipulation logic. Signed-off-by: John Schaeffer <[email protected]>
This check isn't being used anywhere and breaks in CI. This commit removes it. Signed-off-by: John Schaeffer <[email protected]>
fishnix
previously approved these changes
Mar 24, 2023
Signed-off-by: John Schaeffer <[email protected]>
Signed-off-by: John Schaeffer <[email protected]>
fishnix
approved these changes
Mar 24, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The current implementation of authentication in permissions-api expects a URN in the bearer token instead of a JWT. This PR updates permissions-api's API server to use JWT validation from
ginjwtand URN parsing fromurnxfor more robust and secure authentication of clients making API requests.Additionally, to make local development easier, a mock-oauth2-server service has been added to the Compose file. This service can be used to get JWT access tokens that permissions-api can be configured to accept instead of using an external identity provider or other authorization server.